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Abstract 

Under  contract  to  the  European  Space  Agency  (ESA),  an  expert  team  lead  by 
Kayser-Threde  GmbH  has  elaborated  a  design  concept  for  the  Precise  Time  Facility 
(PTF)  for  Europe’s  satellite  positioning  system  Galileo .  The  major  purpose  of  the  PTF 
is  to  generate,  maintain,  and  distribute  Galileo  System  Time  (GST).  The  PTF  is 
represented  by  an  ensemble  of  atomic  clocks  (active  H-maser,  cesium)  with  appropriate 
measurement  equipment  and  time  algorithms.  In  addition,  Two-Way  Satellite  Time 
and  Frequency  Transfer  (TWSTFT)  and  GNSS  Common-View  (CV)  equipment  is 
included,  since  GST  will  be  steered  to  TAI  by  linking  the  PTF  master  clock  to  selected 
European  National  Metrological  Institutes  (NMI).  This  process  shall  be  managed  by 
the  yet  to  be  established  external  Galileo  Time  Service  Provider  (GTSP). 

During  Galileo  In-Orbit  Verification  (IOV),  one  PTF  is  planned  to  be  physically 
implemented,  whereas  for  Final  Operational  Capability  (FOC)  two  identical  and 
redundant  PTFs  at  two  different  sites  in  Europe  are  foreseen.  A  preliminary  PTF 
turn-key  architecture  has  been  proposed  in  2003  by  the  team.  This  architecture  has 
been  further  detailed  during  the  2004  Phase  CO  study.  The  architecture  is  entirely 
based  on  the  results  of  the  previous  Galileo  system  studies  and  the  requirements 
derived  thereof.  In  addition,  the  proposed  turn-key  design  covers  a  number  of  features 
which  are  deemed  key  to  successful  and  timely  procurement,  installation,  and 
operations  of  the  PTF  during  IOV  and  FOC. 

Concerning  the  PTF  design  baseline,  the  redundancy  mechanisms  and  a  reliable 
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connection  between  the  PTF  and  the  GTSP  are  considered  to  be  more  critical  than  the 
GST  generation  and  steering  algorithms ,  where  valuable  experience  exists  worldwide 
at  the  NMIs.  The  critical  issues  mainly  refer  to  parametrization  of  the  GST  algorithm 
and  its  operational  implementation  (e.g.  weighting  of  each  clock  in  the  ensemble , 
redundancy  switching).  Moreover,  reliable  determination  of  the  GPS/Galileo  Time 
Offset  (GGTO),  which  is  planned  to  be  broadcast  by  both  GPS  and  Galileo  to  the  users, 
is  considered  to  be  a  critical  element.  The  paper  reports  about  the  team ’s  PTF  design 
concept  and  the  latest  results  of  the  PTF  algorithm  prototyping  activities. 


1  INTRODUCTION 

Between  November  2003  and  August  2004,  Kayser-Threde  GmbH,  together  with  its  sub-contractors 
TimeTech  GmbH,  the  UK  National  Physical  Laboratory  (NPL),  the  German  Aerospace  Research  Centre 
(DLR),  and  the  German  Physikalisch-Technische  Bundesanstalt  (PTB),  have  been  designing  the  Precise 
Time  Facility  (PTF)  for  Galileo  during  the  so-called  Phase  CO  study.  The  major  purpose  of  the  PTF  is  to 
generate,  maintain,  and  distribute  Galileo  System  Time  (GST).  The  PTF  shall  consist  of  an  ensemble  of 
atomic  clocks  with  appropriate  time  and  frequency  (T&F)  measurement  equipment  and  S/W  filtering 
algorithms.  During  the  Galileo  In-Orbit  Verification  (IOV)  phase,  characterized  by  a  reduced  number  of 
spacecraft,  one  PTF  is  planned  to  be  physically  implemented,  whereas  for  Galileo  Final  Operational 
Capability  (FOC)  two  identical  and  synchronized  PTFs  at  two  different  sites  are  foreseen. 

A  preliminary  PTF  turn-key  architecture  has  been  proposed  in  2003  and  further  detailed  during  the  Phase 
CO  study  in  2004  by  the  team.  The  architecture  is  based  on  the  results  of  the  earlier  Galileo  system 
studies  and  trade-offs,  in  particular  those  of  Phase  B2,  and  the  segment  requirements  derived  thereof.  In 
addition,  our  turn-key  design  covers  a  number  of  features  that  are  deemed  key  to  successful  and  timely 
procurement,  installation,  and  operations  of  the  PTF  during  IOV  and  FOC. 

Concerning  the  technical  PTF  requirements  and  its  present  design  baseline,  the  PTF  redundancy 
mechanisms  are  considered  more  critical  than  the  GST  generation  and  steering  algorithms,  where 
valuable  experience  exists  worldwide  at  National  Metrological  Institutes  (NMI).  Several  outstanding 
critical  issues  refer  to  parametrization  of  the  GST  algorithms  and  their  operational  implementation  (e.g. 
ensemble  algorithm,  redundancy  switching).  These  issues  are  discussed  in  detail  in  the  following 
chapters. 


2  TECHNICAL  REQUIREMENTS 

The  ground  reference  time  system  for  Galileo  which  shall  generate  Galileo  System  Time  (GST)  has  two 

primary  functions: 

1.  Navigation  timekeeping:  this  function  is  critical  for  fulfilling  the  navigation  mission  and  is 
needed  for  Galileo  spacecraft  orbit  determination  and  time  synchronization  (ODTS); 

2.  Metrological  timekeeping:  this  function  is  uncritical  to  the  mission,  but  needed  to  steer  GST 
towards  International  Atomic  Time  (TAI)  and  to  provide  the  UTC  timing  dissemination  service  to  the 
user. 


Navigation  timekeeping  is  the  core  task  of  the  PTF,  whereas  the  metrological  timekeeping  shall  be 
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performed  by  an  external  Galileo  Time  Service  Provider  (GTSP). 


2.1  PTF  Requirements 

In  terms  of  performance  requirements,  the  following  list  provides  a  comprehensive  overview  of  all 

relevant  figures  as  specified  today. 

1.  GST  Frequency  Stability  shall  be  optimized  on  short  term  (x  =  1  day). 

2.  GST  Time  Stability  shall  be  optimized  to  medium/long  term  (x  =  30  days). 

3.  Based  on  above  two  requirements,  the  design  baseline  after  [1]  assumes  1+1  Active  H-Maser  clocks 
(AHM)  for  short-term  timing  plus  3+1  high-performance  cesium  (Cs)  standards  for  long-term  drift 
removal.  This  would  result  in  a  typical  GST  frequency  stability  performance  as  expressed  in  the 
following  figure.  The  extra  AHM  and  Cs  clocks  shall  be  included  as  hot  spares.  We  propose  2+1 
AHM,  which  would  allow  immediate  isolation  of  any  faulty  AHM. 


Figure  1.  Specified  GST  time  stability  (dotted  curve  at  bottom)  based  on  clock  ensemble 
of  1  AHM  +  3  Cs  (G-  =  ground,  S-  =  space) 


4.  GST  Frequency  Offset  (normalized  to  TAI):  <  5.5E-14  (1  day) 

5.  GST  Limits:  accuracy  of  GST  -  TAI  offset  <  50  ns,  2a  (95%  of  any  yearly  interval) 

6.  GST  Uncertainty:  precision  of  GST  -  TAI  offset  <  28  ns,  2a  (95%  confidence  level) 

7.  GST  Autonomy:  accumulation  of  less  than  28  ns  (2a)  uncertainty  over  10  days  (95%  conf.  level) 

To  achieve  above  specified  performance,  a  dedicated  PTF  environment  is  necessary,  which  basically 
should  consist  of  a  separate  clock  operations  room  with  the  following  characteristics:  room  temperature 
25±1°C,  temperature  slope  <  l°C/h,  humidity  50+10%,  dedicated  means  for  magnetic  shielding,  air 
filtering  and  corrosion  prevention,  and  uninterruptable  power  supply  for  at  least  two  consecutive  days. 
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2.2  GTSP  Requirements 

The  main  reason  to  involve  an  external  GTSP  is  simplification  of  the  PTF  core  timekeeping  system  by 
outsourcing  the  metrological  functions  and  relying  on  an  -  already  existing  -  infrastructure.  It  will  enable 
national  timing  labs  UTC  (k)  and  commercial  providers  to  research  and  improve  GST  generation 
independently  and  to  find  the  best  approach  for  UTC  dissemination  via  the  Galileo  FOC  system. 

This  will  most  probably  result  in  considerable  cost  savings  for  the  PTF  itself.  Moreover,  such  shared  task 
allocation  will  enable  to  continuously  improve  the  timing  service  of  Galileo  without  frequent  changes  of 
the  core  infrastructure,  e.g.  by  involvement  of  new  and  better  (external)  clocks  or  better  TAI  prediction 
algorithms.  This  in  turn  will  support  the  inevitable  comparison  with  the  ongoing  and  planned  GPS 
modernisation  initiatives  in  the  US  and  will  help  to  stabilize  and  promote  GST  in  the  long  term.  It  is 
assumed  that  the  challenge  of  an  ever  improved  GPS  time  in  the  coming  years  can  be  faced  best  by  such 
work  share  between  PTF  and  GTSP  and  still  create  long-term  confidence  to  the  Galileo  user  in  the  quality 
and  performance  of  the  Galileo  time  product  and  services. 

Based  on  these  assumptions,  all  GTSP  tasks  are  summarized  in  the  following  list: 

1.  install  and  operate  two-way  satellite  T&F  transfer  (TWSTFT)  and  common- view  (CV)  equipment 
at  the  PTF,  which  shall  be  driven  by  the  physical  realization  of  GST 

2.  operate  daily  links  to  n  UTC  (k)  labs  (at  least  three;  required  for  reliable  determination  of  TAI 

offset)  including  periodic  calibration  of  equipment  as  well  as  provision  and/or  leasing  of 
external  infrastructure  (e.g.  satellite  transponder  time) 

3.  receive  GST  parameters,  individual  clock  data  Cki  and  clock  ensembling  information  from  PTF 

4.  perform  data  analysis  of  all  measurements  GST  -  Cki  and  GST  -  UTC  (k) 

5.  develop  and  operate  TAIP  prediction  algorithm 

6.  provide  daily  predicted  value  of  (TAIP  -  GST)  time  and  frequency  offset  and  daily  frequency 

steering  correction  to  PTF 

7.  provide  current  value  of  UTC  -  TAI  time  offset  (leap  seconds)  to  PTF 

8.  interface  with  BIPM  by  exchange  of  all  relevant  clock  data 

9.  support  extended  scientific  activity. 


Figure  2  summarizes  the  most  important  PTF  and  GTSP  tasks  and  gives  an  overview  of  the  relations 
between  PTF  and  GTSP. 
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2.3  Requirements  for  IOV 

Concerning  the  requirements  and  the  design  baseline  as  defined  in  Phase  B2  for  Galileo  IOV,  [2]  states 
that  “due  to  the  equivalent  number  and  type  of  operative  clocks  in  the  PTF  (i.e.  3  Cs  and  1  AHM),  which 
will  be  used  both  in  FOC  and  IOV,  the  same  algorithm  and  the  same  stability  performances  are  expected 
both  in  FOC  and  IOV  ...  The  following  table  summarizes  the  functions  that  can  be  tested  during  IOV  and 
the  level  of  verification  achievable.” 


Galileo  Control  Centre 
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Figure  2.  Task  allocations  and  links  between  PTF  (left)  and  GTSP  (right)  after  [1],  SPF  = 
“Service  Products  Facility”.  I/F  to  GPS  (USNO)  not  shown  here. 


Table  1.  PTF  functions  testable  during  IOV  after  [2]. 


Function 

Performance  level 
achievable  at  IOV 

GST  Generation 

FOC 

Steering  to  TAI 

To  be  agreed  with  GTSP 

Determination  of  GGTO 

-  FOC 

Dissemination  of  GST  to 
fixed  user 

-  FOC 

Dissemination  of  UTC 

Depending  on  GTSP 

Switching  from  PTF1  to  PTF2 

Depending  on  UTC(k)  lab  to 
be  used  as  PTF2 

The  above  statements  are  valid  as  far  as  GST  performance  is  concerned.  As  far  as  important  other 
functions  are  concerned,  in  particular  redundancy  and  master  clock  switching  mechanisms,  the  PTF 
architecture  baseline  for  IOV  is  deemed  not  sufficient.  Assuming  an  adequately  equipped  and 
experienced  UTC  (k)  lab  with  NMI  functions  is  involved  as  GTSP,  it  would  have  to  burden  the  three-fold 
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work  load  of  acting  as  GTSP  with  all  related  tasks,  providing  and  operating  back-up  master  clock(s),  and 
still  providing  national  metrological  service  in  the  T&F  area. 

Since,  moreover,  the  PTF  redundancy  mechanisms  are  considered  more  critical  than  the  GST  generation 
and  steering  algorithms,  where  valuable  experience  exists  worldwide,  the  presently  defined  focus  of  the 
PTF  related  tasks  during  IOV  should  be  reconsidered  carefully. 

Alternatively,  facilities,  equipment,  and  operational  expertise  available  in  non-NMI  time  labs  and  industry 
inch  the  ESA  deep  space  tracking  facilities  in  New  Norcia  or  Cebreros  (both  equipped  with  AHM  clocks, 
CV/TWSTFT  equipment,  etc.)  could  be  re-used  to  test: 

a)  phase-synchronous  switching  between  the  master  and  the  hot-spare  AHM  within  the  master 
PTF, 

b)  steering  of  the  slave  to  the  master  PTF  and  switching  from  the  master  to  the  slave  PTF  (will 
have  non-negligible  procedure/effect  on  ODTS). 

In  addition,  it  is  considered  inevitable  to  evaluate  operational  PTF  procedures  and  to  gain  hands-on 
experience  with  clocks  and  timing  equipment  at  the  earliest  possible  state  of  implementation.  According 
to  NMI  experience,  such  processes  generally  last  several  years,  in  particular  when  covering  detection  of 
yearly  changes  to  clocks,  facilities,  etc.  It  is,  therefore,  recommended  to  put  in  operation  both  the  master 
PTF  and  the  GTSP  already  for  IOV. 


3  ARCHITECTURE  BASELINE 

To  fulfill  the  above  objectives  and  specifications,  the  Galileo  PTF  should  consist  of  the  following  major 
components/ sub-systems : 

1.  Clock  ensemble; 

2.  Local  T&F  measurement  subsystem,  consisting  of: 

■  core  measurement  equipment; 

■  support  measurement  equipment. 

3.  GST/GGTO  data  processing  subsystem; 

4.  GST  realization  subsystem; 

5.  T&F  comparison  subsystem  (synchronization  links); 

6.  Time  data  interfaces  subsystem,  made  up  of: 

■  external  communication  I/F  and 

■  data  storage/archiving  facilities; 

7.  Monitoring  &  Control  (M&C)  subsystem,  incl.  environmental  sensors. 

Figure  3  shows  a  block  diagram  of  the  PTF  architecture  designed  by  the  Phase  CO  study  team  covering 
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any  of  the  above-mentioned  sub-systems/major  equipment. 

4  ALGORITHMS  BASELINE 

4.1  GST  Generation  and  Steering 

Preliminary  analysis  of  the  GST  generation  and  steering  algorithms  worked  out  in  Phase  B2  and  GSTB- 
VI  has  lead  to  the  conclusion  that  the  solution  proposed  in  the  baseline  is  sound  and  feasible.  GST 
generation  is  described  in  detail  in  [1]  and  [3].  The  basic  approach  is  to  establish  a  physical  realization  of 
GST  by  steering  the  output  of  an  AHM  operated  at  PTF  to: 

a)  TAI  with  the  help  of  a  steering  correction  provided  by  the  GTSP,  and/or 

b)  the  free-running  ensemble  timescale  (GSTR)  computed  from  the  Cs  clocks  operated  at  the 
PTF. 
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Figure  3.  PTF  Architecture  Baseline  as  proposed  by  Phase  CO  study  team. 


[1]  defines  that  in  IOV  configuration  only  one  PTF  should  be  operational,  equipped  with  1  AHM  and  3 
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Cs  clocks.  Considering  this  configuration,  the  generation  of  GST  can  be  represented  at  the  conceptual 
and  physical  levels  as  illustrated  in  Figure  4.  Note  that  neither  cabling,  networks,  processing  units,  nor 
the  Monitoring  and  Control  Subsystem  are  shown. 

GST  generation  in  FOC  will  follow  the  same  scheme  as  in  IOV,  but  will  involve  redundant  elements  [1, 
3].  The  most  important  of  these  elements  are:  second  AHM  clock,  fourth  Cs  clock,  second  micro-phase- 
stepper,  and  redundant  cabling.  We  propose  to  operate  3  AHMs,  which  would  allow  immediate  isolation 
of  any  faulty  AHM.  Since  two  PTFs  shall  be  operated,  dedicated  algorithms  and  procedures  to  manage 
the  redundancies  (failure  detection,  switching  procedures,  etc.)  will  be  required  for.  These  are  discussed 
in  Section  5. 


Steering  algorithm 


. t  ^ 

Ensemble 

algorithm 

t  f  -i 


GST-TAI 
correction 
from  TSP 


AHM 


Ipps 


frequency 


Figure  4.  GST  generation/steering  chain:  conceptual  level  (left),  physical  level  (right). 


4.2  GGTO  Determination 

Since  Galileo  will  rely  on  its  own  internal  time  scale  (GST),  but  future  users  most  likely  will  (have  to) 
handle  a  combination  of  both  GPS  and  Galileo  data,  it  has  been  decided  to  include  a  common  pre¬ 
determined  Galileo/GPS  Time  Offset  (GGTO)  parameter  in  the  navigation  messages  of  both  systems. 
This  will  enable  users  with  limited  satellite  visibility  (e.g.,  two  Galileo,  two  GPS)  to  process  valid 
solutions  without  the  need  to  solve  for  the  time  unknown. 

A  basic  GGTO  determination  scheme  has  been  worked  out  in  Phase  CO  and  is  shown  in  the  figure  below. 
It  uses  data  of  a  GPS  time  receiver  and  TWSTFT  equipment,  both  installed  at  the  PTF  and  driven  by 
GST.  More  details  about  the  GGTO  algorithm  can  be  found  in  [5]  and  [6]. 
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UTC(USNO)  -  GPS  Time 
(data  from  USNO) 


Computed  GGTO  parameter 
and  quality  characteristics 
from  USNO/GPS  side 


Figure  5.  GGTO  determination  scheme  as  proposed  by  Phase  CO  study  team. 


5  FAILURES  AND  REDUNDANCIES 

5.1  Failure  Identification 

The  following  table  illustrates  possible  failure  events  on  PTF  component  level,  which  are  relevant  to  the 
GST  and  GGTO  generation  chains  in  the  context  of  the  present  PTF  redundancy  concepts  as  defined  for 
IOV  and  FOC.  The  events  were  identified  based  on  operational  experience  in  NMIs  and/or  time 
laboratories. 

The  probability  of  events  is  designated  as  follows:  “M”  -  medium  (in  order  of  a  few  times  a  year),  “L”  - 
low  (in  order  of  one  or  two  times  during  the  component  lifetime).  The  probability  of  certain  GST 
algorithm  failures  can  presently  not  be  estimated  due  to  the  lack  of  knowledge  on  failure  detection 
procedures  in  these  algorithms  and  their  verification.  Moreover,  the  failures/malfunctions  of  the 
following  components  are  presently  not  considered: 

■  cables  (which  typically  do  not  produce  long-lead  failures  if  they  were  initially  properly  tested); 

■  data  collection/device  control  S/W  (needs  to  be  included  in  further  detailed  analysis). 
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Table  2.  Possible  failure  events  on  PTF  components  (list  not  exhaustive). 


Component 

Pr 

Event 

AHM  clock 

M 

Temporary  malfunction  (phase  or  frequency 
step)  affecting  both  Ipps  and  RF  outputs 

M 

Degradation  of  performance  (increase  of 
frequency  drift,  increase  of  ADEV)  affecting 
both  Ipps  and  RF  outputs 

L 

Failure  of  single  output  (either  1  pps  or  RF 
output  is  not  available) 

L 

Device  failure  (all  Ipps  and/or  RF  outputs  are 
not  available) 

Cs  clock 

L 

Temporary  malfunction  (phase  or  frequency 
step)  affecting  both  Ipps  and  RF  outputs 

L 

Degradation  of  performance  (increase  of 
frequency  drift,  increase  of  ADEV),  affecting 
both  Ipps  and  RF  outputs 

L 

Failure  of  single  output  (either  1  pps  or  RF 
output  is  not  available) 

L 

Device  failure  (all  Ipps  and/or  RF  outputs  are 
not  available) 

Multiplexer 

M 

False  switching  (wrong  input  is  connected  to 
the  device  output) 

Component 

Pr 

Event 

L 

Degradation  of  performance  of  single  input 
(e.g.  loose  contact  on  relay) 

L 

Failure  of  single  input  (one  Ipps  or  RF  output 
is  not  available) 

L 

Device  failure  (multiplexer  not  working) 

TIC 

L 

Degradation  of  performance 

L 

Device  failure  (TIC  not  working) 

Micro  phase 
stepper 

L 

Degradation  of  MPS  output  performance  (e.g. 
increase  of  noise  due  to  MPS  Fl/W  problems) 

L 

Device  failure  (MPS  not  working) 

GST  Pulse 
distributor 

L 

Degradation  ofperformance  of  one  pulse 
distributor  output  (e.g.  increase  of  noise  in 
terms  of  ADEV) 

L 

Failure  of  one  distributor  output 

L 

Device  failure  (distributor  not  working) 

GST  RF 
distributor 

L 

Degradation  of  performance  of  one  RF 
distributor  output  (e.g.  increase  of  noise  in 
terms  of  ADEV) 

L 

Failure  of  one  RF  distributor  output 

L 

Device  failure  (distributor  not  working) 

5.2  Failure  Handling 

Failure  handling  covers  high-level  measures  that  should  preferably  be  undertaken  automatically  at  the 
PTF  following  detection  of  a  failure  in  the  GST  generation  chain  (maser  -  phase  stepper  -  distributor  - 
receiver)  to  restore  generation  of  GST  and  to  eliminate  any  impact  on  GST  performance.  We  consider 
redundancy  handling  issues  to  be  a  critical  point  in  GST  generation;  therefore,  we  propose  to  test  the 
corresponding  mechanism  already  during  IOV  to  ensure  their  proper  functioning  at  and  after  reaching 
FOC.  Thus,  the  PTF  configuration  would  be  in  IOV  basically  the  same  as  in  FOC  (only  one  Cs  clock 
less).  The  switching  between  the  PTFs  could  be  tested  in  collaboration  with  an  existing  time  laboratory 
orNMI. 

The  current  baseline  [i]  foresees  the  failure  handling  to  be  executed  at  the  level  of  individual  PTF 
components.  This  strategy  implies  the  ability  to  detect  a  failed  component  and  to  execute  the  switching 
or  other  response  measures  within  such  a  short  interval  of  time  that  would  make  the  failure  non-critical 
for  the  overall  system  performance. 

It  is  understood  that  this  interval  of  time  (which  is  basically  the  requirement  of  maximum  Time-To-Repair 
for  GST)  is  set  mainly  by  the  ODTS  processing.  Assuming  that  the  navigation  processing  is  executed  in 
ODTS  in  10  minutes  batches,  and  the  update  (upload)  rate  of  satellite  navigation  messages  is  90  minutes, 
we  consider  the  Time-To-Repair  of  GST  to  be  equal  to  the  interval  that  would  lead  in  the  worst  case  to  a 
loss  of  two  processing  batches.  Note  that,  in  the  current  baseline,  the  PTF  is  not  included  in  the  integrity 
chain;  therefore,  we  do  not  consider  here  requirements  w.r.t.  the  integrity  processing,  which  would  lead  to 
Time-To-Repair  of  GST  of  less  than  1  s. 

Figure  6  illustrates  the  logic  of  the  switching  and  steering  mechanism  as  proposed  in  Phase  B2.  It  is 
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foreseen  that  one  of  the  H-masers  (AHMla  in  Figure  6)  represents  GST  the  Master  Clock  (MC).  The 
other  AHM  is  working  as  hot  spare  MC,  and  the  second  PTF  is  operated  on  a  master-slave  basis  with  the 
primary  one.  Note  that  titles  as  “MC”  or  “primary”  refer  only  to  the  role  of  a  certain  element  and  does 
not  constitute  a  permanent  designator;  these  roles  may  change  during  Galileo  operations  as  a  result  of 
switching  between  individual  elements  or  components. 

We  found  that,  in  real  operations,  it  will  be  hardly  possible  to  make  all  switching  operations  automatic.  It 
would  be  possible  to  some  extent  to  automate  the  detection  and  corresponding  switching  for  failures 
related  to  the  lack  of  output  signals  on  PTF  components.  However,  such  failures  as  performance 
degradation  of  a  component  or  situations  when  a  planned  maintenance  should  be  executed  would  involve 
certain  manual  operations  that  would  require  trained  personnel. 


PTF1  PTF2 


Figure  6.  Baseline  PTF  switching  and  steering  mechanism  in  FOC  after  [1]. 


Following  these  guidelines,  our  Phase  CO  approach  is  deemed  to  be  more  reliable  and  much  simpler  in 
operation  than  the  Phase  B2  baseline.  We  propose  to  place  the  switch  inside  the  ODTS  functions  (Figure 
7).  This  way,  the  switching  process  load  would  be  reduced  to  solely  informing  ODTS  that  switching  has 
occurred  and  which  AHM  is  the  MC.  ODTS  should  then  derive  GST  from  the  corresponding  data  set. 

In  fact,  each  of  the  AHM  could  be  connected  to  its  “own”  Galileo  Time  Receiver  (collocated  within  each 
PTF)  and  the  data  from  all  four  receivers  (two  at  each  of  the  PTFs)  could  be  delivered  to  ODTS  via 
standard  data  transfer  interfaces. 

The  overall  switching  logic  is  rather  simple,  leaving  individual  modules  and  steering  schemes  unaffected 
by  failures  in  other  modules.  Note  that  all  AHM  are  steered  to  GSTR  (which  is  the  free-running 
ensemble  time)  as  produced  at  the  PTF,  and  that  each  GSTR  is  individually  steered  to  TAI.  Moreover, 
this  concept  allows  a  much  higher  flexibility  and  a  simple,  but  powerful  scalability  throughout  the  various 
Galileo  implementation  phases. 
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PTF1  PTF2 


Figure  7.  Alternative  PTF  switching  and  steering  mechanism  as  proposed  by  Phase  CO  study  team. 


To  avoid  phase  and  frequency  steps  in  GST  following  any  switching,  it  is  advisable  to  use  a  GST  model 
(e.g.,  a  linear  polynomial)  within  ODTS.  The  model  should  be  activated  following  a  switching  to 
compensate  the  GST  step.  Its  coefficients  (time  and  frequency  offsets  between  the  AHMs)  can  be 
determined  from  PTF  measurements  and  ODTS  processing  results. 

Hardware  realization  of  such  switching  scheme  within  one  PTF  is  illustrated  in  Figure  8,  showing  the 
individual  GST  generation  chains  (AHM  -  stepper  -  distributor  -  receiver).  Note  that  there  is  no  H/W 
switching  element  on  PTF  side;  thus,  following  a  failure  in  one  of  the  GST  generation  chains,  personnel 
will  have  rather  moderate  time  constraints  for  organizing  repair  or  replacement  of  failed  components. 
The  system  could  always  run  without  impact  on  GST  performance  (but  with  reduced  reliability  until  the 
failed  chain  will  have  been  repaired).  Absence  of  H/W  switching  elements  simplifies  PTF  operation  and 
increases  system  reliability.  This  design  has  also  benefits  from  the  AIT  point  of  view,  as  each  module  can 
be  built,  assembled,  and  tested  separately  without  disturbance. 

There  is  a  need  to  define  where  the  decision  on  selection  of  the  master  clock  and  on  switching  occurs. 
PTF  is  not  a  good  candidate,  since  a)  the  two  PTFs  may  come  to  contradictious  decisions,  and  b)  it  is 
desirable  to  have  a  human  supervision  of  the  decision  making.  Thus,  it  is  advisable  to  allocate  the 
responsibility  for  GST  definition  and  switching  to  one  of  the  manned  facilities  of  the  Galileo  Ground 
Control  Centre  (GCC).  PTF  should  provide  comprehensive  clock  monitoring  data  and  warning  messages 
to  support  the  decision  making. 
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Figure  8.  Independent  hardware  chains  for  each  AHM. 


6  SUMMARY  AND  CONCLUSIONS 

The  main  recommendations  worked  out  in  the  PTF  Phase  CO  design  study  can  be  summarized  as  follows. 
Due  to  limited  experience  on  implementation  of  automatic  redundancy/failure  management  systems,  it  is 
advisable  to  implement  and  test  the  corresponding  mechanisms  and  algorithms  already  during  IOV. 
Otherwise,  there  is  a  danger  to  enter  FOC  with  a  not  thoroughly  tested  PTF  that  may  fail  to  meet  the 
requirements  on  availability  and  reliability  of  GST. 

The  mission  of  not  only  FOC,  but  also  IOV  critically  depends  on  the  availability  and  performance  of 
GST.  From  practical  experience,  it  is  known  that  the  most  critical  PTF  components  are  at  the  same  time 
long-lead  items  (6  months  or  more).  Moreover,  they  are  produced  only  by  very  few  manufactures 
worldwide.  In  particular,  the  work  horse  of  GST  -  the  AHM  clock  -  is  known  to  be  more  a  scientific 
than  a  commercial  instrument,  whose  failure  modes  are  not  very  well  studied.  Therefore,  it  is  advisable  to 
have  hot  spares  for  critical  PTF  components,  including  the  AHM  already  in  IOV.  The  impact  of  the 
procurement  of  PTF  hot  spares  on  the  overall  IOV  costs  is  estimated  to  be  rather  moderate. 

The  Phase  B2  baseline  that  foresees  physical  steering  of  all  backup  AHMs  to  the  MC  is  rather  complex  in 
implementation  and  operation.  Switching  would  in  addition  require  skilled  personnel  to  undertake  certain 
activities  within  a  rather  short  reaction  time.  Our  alternative  approach  seems  to  be  more  attractive  in 
terms  of  reliability  and  simplicity  of  operation.  In  our  approach  each  GST  generation  chain  (maser  - 
phase  stepper  -  distributor  -  Galileo  receiver)  will  be  operated  separately  and  deliver  its  data 
continuously  to  the  ODTS  function.  ODTS  will  then  derive  GST  from  the  data  relating  to  the  AHM 
currently  assigned  as  the  MC.  No  hardware  switching  is  needed  and  no  immediate  actions  by  the  GCC 
personnel  on  PTF  hardware  are  required  to  realize  the  switching.  The  switching  itself  is  limited  to  some 
actions  within  ODTS  that  would  have  to  derive  GST  from  another  set  of  observations  corresponding  to 
the  new  MC. 
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The  Phase  B2  baseline  architecture  foresees  physical  steering  of  all  AHMs  to  the  (current)  master  one. 
The  stringent  steering  requirements  can  be  hardly  met  due  to  intrinsic  calibration  errors  of  the 
measurement  equipment.  An  alternative  solution  is  to  steer  all  AHMs  to  individual  free-running 
ensemble  time  scales  GSTRs  produced  at  corresponding  PTFs,  and  steer  these  GSTRs  in  turn  to  TAI.  As 
a  result,  all  AHMs  will  be  kept  very  close  to  each  other.  To  compensate  for  steps  following  any 
switching  between  the  AHMs,  a  GST  model  (e.g.,  a  linear  polynomial)  might  be  used  in  ODTS. 
Coefficients  of  this  model  can  be  determined  using  both  the  results  of  ODTS  processing  and  the  clock 
measurements  made  at  the  PTFs. 

In  any  case,  it  is  desirable  that  ODTS  provides  a  feedback  to  PTF  about  its  estimates  of  the  quality  of  the 
PTF  raw  data  and  the  quality  of  GST,  since  these  effects  are  not  immediately  visible  to  PTF.  This 
information  would  complement  clock  monitoring  made  at  PTF  and  assist  a  reliable  real-time  assessment 
of  the  quality  of  GST. 
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